lyccyc/cve-2023-41892_pocProof-of-concept scripts and Docker lab for reproducing CVE-2023-41892, a pre-authenticated remote code execution vulnerability in Craft CMS. Includes log poisoning and Imagick MSL file write exploits.
This repository contains proof-of-concept scripts and a local Vulhub lab for reproducing CVE-2023-41892, a pre-authenticated remote code execution vulnerability in Craft CMS.
Use this project only in an authorized local lab or other systems where you have explicit permission to test.
CVE-2323-41892_PoC/
+-- README.md
+-- LFI_to_RCE.py
+-- Imagick_PoC.py
+-- Vulnhub_env/
+-- docker-compose.yml
+-- README.md
+-- README.zh-cn.md
+-- 1.png ... 5.png
| Path | Purpose |
|---|
LFI_to_RCE.py | PoC for log poisoning followed by local file inclusion through the Psy\Configuration gadget. |
Imagick_PoC.py | PoC for arbitrary file write through the Imagick MSL gadget. |
Vulnhub_env/docker-compose.yml | Docker Compose lab that starts vulnerable Craft CMS 4.4.14 and MySQL 5.7. |
Vulnhub_env/README.md | Original Vulhub-style reproduction notes with request examples and screenshots. |
Vulnhub_env/README.zh-cn.md | Chinese version of the Vulhub reproduction notes. |
Vulnhub_env/*.png | Screenshots used by the Vulhub environment documentation. |
CVE-2023-41892 affects Craft CMS versions from 4.0.0-RC1 through 4.4.14.
The issue was fixed in Craft CMS 4.4.15.
The vulnerable endpoint used by both scripts is:
/index.php?action=conditions/render
The PoCs target the default local lab URL:
http://localhost:8088
If your lab runs on another host or port, update the URL value near the top of
LFI_to_RCE.py and Imagick_PoC.py.
requestsInstall the Python dependency:
pip install requests
Start the vulnerable Craft CMS environment:
cd Vulnhub_env
docker compose up -d
Open the Craft CMS installer:
http://localhost:8088/admin/install
Use the following default database settings during installation:
| Setting | Value |
|---|---|
| Database host | db |
| Database name | craftcms |
| Database user | root |
| Database password | root |
After installation, confirm the site is reachable at:
http://localhost:8088
Run the commands from the repository root:
cd CVE-2323-41892_PoC
Run:
python LFI_to_RCE.py
What it does:
Sends malformed JSON containing PHP code to the Craft CMS log.
Builds a log file path using the current local date:
../storage/logs/web-YYYY-MM-DD.log
Uses craft\elements\conditions\users\UserCondition with
\Psy\Configuration to include the poisoned log file.
Checks whether phpinfo() output appears in the response.
Expected success output:
[*] Starting Log Poisoning...
[+] Payload sent successfully!
[*] Starting LFI to RCE...
[+] phpinfo() executed successfully!
Run:
python Imagick_PoC.py
What it does:
Imagick gadget.webshell.php into the web root.http://localhost:8088/webshell.php and checks for phpinfo().Expected success output:
[*] Sending multipart/form-data payload to trigger Imagick gadget...
[+] Success: phpinfo() output found.
The Imagick path may crash the PHP worker after the payload is triggered. In the
Vulhub lab this can still be normal if webshell.php is written before the
crash.
Both scripts define the target URL at the top of the file:
URL = "http://localhost:8088"
Change this value if the vulnerable lab is exposed on another address.
Imagick_PoC.py checks the generated file at:
OUTPUT_FILE = "/webshell.php"
Confirm the containers are running:
cd Vulnhub_env
docker compose ps
Confirm the site is reachable at http://localhost:8088.
Check whether another service is already using port 8088.
Update the URL value in the Python scripts if you changed the exposed port.
LFI_to_RCE.py does not show PHP Versionstorage/logs/.web-YYYY-MM-DD.log
path in LFI_to_RCE.py.Imagick_PoC.py returns 404 for /webshell.php/tmp/php*.Stop the lab:
cd Vulnhub_env
docker compose down
Remove containers and the database volume if you want a clean reinstall:
docker compose down -v
Upgrade Craft CMS to 4.4.15 or later.
If exploitation is suspected, rotate the Craft CMS security key, database credentials, application secrets, and any credentials stored in the environment.